Splunk Search

cohorting with fixed first event dates

stephenreece
New Member

morning all,

I am struggling with the logic around doing this.

I am trying to run a report from 01/01/2018 to today looking at how many times (ideally in a range), that users are using the service. (what they do is almost irrelevant, just that they are on it is enough.

The challenge is 1 want 2 years of behaviour and not anyone using it within 2 years...

so ideally i need to isolate all users who entered in say 01/01/2018 to 01/02/2018 and then what their behaviour has been over the 2 years since.

What i have so far is:

sourcetype=mymainsourcetype
| stats values(_time) as source by clientIP

(this is ideal as i get to see ALL the users and their entries (however i now need to isolate just where the first entry is between 1st jan 18 and 1st feb 18.

any ideas would be great

Tags (1)
0 Karma

to4kawa
Ultra Champion
index=mymainindex sourcetype=mymainsourcetype starttime=01/01/2018:00:00:00 endtime=02/01/2018:00:00:00 clientIP=*
| stats count(_time) as appear_count min(_time) as first_appear max(_time) as last_appear range(_time) as duration list(_time) as time_list by clientIP
| foreach *_appear  [ fieldformat <<FIELD>>=strftime(<<FIELD>>,"%c")]

You should check the status of clientIP with this search and then consider the next search method.

0 Karma

stephenreece
New Member

i've found starttime=01/01/2018:00:00:00 endtime=02/01/2018:00:00:00 which is one step close

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...